Security

POP FX exposes a deliberately narrow, read-only tool surface. It does not execute model-generated JavaScript, HTML, shell commands, or arbitrary remote assets.

Controls

• Strict JSON-RPC and modern MCP header validation.
• Fixed allowlisted effect catalog and bounded schemas.
• 32 KB request-body cap and 2,000-character content cap.
• Intensity hard-clamped to 1–5.
• Cloudflare native rate limiting on compute endpoints.
• Content Security Policy with per-response script nonces on render pages.
• Render data canonicalized client-side from approved presets.
• No autoplay audio; reduced-motion support is built in.
• Cloudflare observability enabled with query-string redaction.

Side effects

None. Current MCP tools return specifications and render URLs only.